reportEU AI ActAI Governance
EU AI Act national implementation: 129 Member State records, plus 18 comparators
As of 7 Sep 2026: 129 records across the 27 Member States, plus 18 in EEA, Switzerland and the UK; 9 Member State acts are in force.
Edited and verified by Cognesio LLP
Researched with AI assistance · sources verified by Cognesio LLP · How this was made ↓
In the European Union, the AI Act now has a national layer: implementing laws, designation notices, penalty rules, regulatory sandboxes and deployer guidance issued by Member States as Regulation (EU) 2024/1689 applies in phases after Regulation (EU) 2026/1744. As of 7 September 2026, the SafeLegalAI national implementation record covers 129 instruments and authority pages across the 27 Member States, plus 18 in Norway, Iceland, Liechtenstein, Switzerland and the United Kingdom. In the Member States, 9 implementing acts are in force, 20 states have a market-surveillance authority recorded, and 14 have an Article 57 sandbox recorded.
Key findings
- As of 7 September 2026 the SafeLegalAI national implementation release covered 147 national instruments and authority pages across 32 states: 129 for the 27 Member States and 18 for Norway, Iceland, Liechtenstein, Switzerland and the United Kingdom.
- Nine Member States had an implementing act in force on 7 September 2026, by the gazettes and authority pages read for this report: Denmark from 2 August 2025, Finland from 1 January 2026, Hungary from 1 December 2025, Italy and Malta from 10 October 2025, Greece from 20 July 2026, Ireland from 21 July 2026, Germany from 29 July 2026 and Poland from 11 August 2026.
- Eighteen Member States did not yet have an in-force implementing act in the sources read: 2 had adopted instruments, 2 had bills, 6 had drafts and 8 had no national implementing act found.
- The Member State sources identify market-surveillance authorities in 20 Member States, single points of contact in 19, notifying authorities in 17 and Article 77 fundamental-rights authorities in 11.
- Article 99 penalty regimes were found for 11 Member States: 6 in force, 2 adopted, 1 in a bill and 2 still draft as of the source read date.
- Article 57 sandboxes were found in 14 Member States: Denmark, Lithuania and Spain were operational, Malta, Poland and Slovenia had a designated operator, and 8 more were announced.
- Deployer guidance appeared for 12 Member States, with 13 guidance items in total because Austria has both a federal Public AI page and an RTR AI Service Desk page.
- Only Belgium had a Member State Digital Omnibus position in this release; Switzerland had a non-EU position recording its separate Council of Europe Convention route.
Why this question
The Union-level AI Act pages say what the Regulation requires and when the dates moved. They do not tell a court supplier, a bar regulator or a firm with EU-facing work which national body will receive a complaint, run a sandbox or set a local penalty procedure. That question is national.
The connected SafeLegalAI pieces should be read once, then kept separate. The September 2026 update records the Digital Omnibus and Union dates; the milestones report tracks Article 113; the obligations report maps duties for firms and vendors; the UK explainer covers extraterritorial scope. This report records the Member State layer.
That layer matters because the Commission does not publish one finished enforcement map. SafeLegalAI’s earlier authority release has 29 entries, mostly from the Commission single-point-of-contact table. Nineteen of those entries still say no contact is designated. For the national matrix below, SafeLegalAI therefore reads gazettes, parliaments and authority pages state by state.
Method and data
The report uses the SafeLegalAI EU AI Act hub at /regulation/eu-ai-act, the state pages at /regulation/eu-ai-act/<cc>, and the GitHub and Hugging Face release at github.com/SafeLegalAI/eu-ai-act-structured, table member_states. It also uses the earlier authority release and the milestones release for the Digital Omnibus dates.
Each national record has a category, an official source link, a read date, a verification state, an archive link where available and, where quoted, an original-language excerpt kept to 25 words or fewer. The verification states mean: read from the gazette or authority page; read from a public mirror; official page opened but the document not retrieved; or link only. Machine translations are flagged in the release: 110 of the 147 all-state records use SafeLegalAI translations.
The Future of Life Institute’s implementation tracker was used as a lead on 60 rows; no row relies on a tracker as its source. Status is the source status as of the read date, not a legal conclusion after that date. The Commission page recorded in the release says, “The Commission is considering the notifications and will publish a list of Single Points of Contact in due time.” It also says the list is “updated continuously”; it has not replaced the national documents in this report with a single consolidated market-surveillance-authority list.
Verification counts were generated by script: 138 records were read from the gazette or authority page, 4 from a public mirror, 4 from an official page where the document was not retrieved, and 1 as link only. The script counted 81 distinct source links and 78 distinct source links read from a gazette, authority page or mirror. Known limits are specific: Lithuanian ministry and E-TAR pages were not readable in the collection run, Cyprus government material was read through Wayback, Greece’s gazette PDF was not retrieved, and Slovakia’s ministry page was blocked.
The 32-state national matrix
The matrix answers the national question in one table: which instrument is in force or pending, which body is named for market surveillance, the single point of contact and notification, whether a sandbox exists, whether a penalty regime exists, and whether guidance reaches deployers. The table includes non-EU comparators, but the legal duty to implement Article 70 and Article 57 belongs to Member States. For sandboxes, the operative deadline used here is 2 August 2027, based on Regulation (EU) 2026/1744 and the milestones release; the Commission Service Desk article page for Article 57 still showed 2 August 2026 when read.
Implementing acts and penalties
The national implementing act is the cleanest status signal. It shows whether the Member State has moved from general preparation into a legal instrument. Germany’s KI-MIG says, “Dieses Gesetz dient der Durchführung der Verordnung (EU) 2024/1689”. Finland’s law states, “Tämä laki tulee voimaan 1 päivänä tammikuuta 2026”. Spain remains a bill.
| Instrument category | EU entries | Status split |
|---|---|---|
| National implementing act | 19 | in force 9; adopted 2; bill 2; draft 6 |
| Penalty regime under Article 99 | 11 | in force 6; adopted 2; bill 1; draft 2 |
The in-force penalty regimes are Germany, Denmark, Finland, Hungary, Malta and Poland. Italy is listed as adopted because Law 132/2025 delegates further AI Act adaptation and sanctions; the source phrase is “sistema di sanzioni effettive, proporzionate e dissuasive”. Slovenia is listed as adopted for its published offences and fines. Spain’s Article 99 penalty regime sits in Bill 121/000096. Romania and Sweden have draft texts.
Eight Member States have no national implementing act in the release: Austria, Belgium, Bulgaria, Estonia, France, Croatia, Portugal and Slovakia. This does not mean no AI governance page exists. Austria has an RTR AI Service Desk and Article 77 list; France has an announced authority scheme; Portugal has a justice-minister speech; Estonia and Slovakia have deployer guidance.
Authorities, including Article 77 bodies
The authority map is split between formal designations and pages that announce a proposed model. Market-surveillance authorities appear for 20 Member States, but only 28 of the 41 market-surveillance listings are final designations. For Article 77, 11 Member States have named authorities, including Austria and Belgium even though neither has a final Article 70 implementing instrument in this release.
| Authority role | EU states | EU entries | Status split |
|---|---|---|---|
| Market surveillance authority | 20 | 41 | adopted 1; designated 28; announced 6; bill 2; draft 4 |
| Single point of contact | 19 | 24 | adopted 1; designated 16; operational 1; announced 3; bill 1; draft 2 |
| Notifying authority | 17 | 20 | designated 16; announced 1; bill 1; draft 2 |
| Fundamental-rights authority | 11 | 11 | designated 9; announced 2 |
| State | Article 77 authority or authorities | Status | Source |
|---|---|---|---|
| Austria | Volksanwaltschaft, Datenschutzbehörde, equality, labour, media, election, consumer bodies | designated | AI Act: Article 77 strengthens fundamental rights |
| Belgium | Multiple federal, Brussels, Flemish, German-speaking, French Community and Walloon authorities | designated | Overview of Belgian authorities for the protection of fundamental rights |
| Cyprus | Personal Data Protection Commissioner; Ombudsman; Attorney-General | designated | Fundamental Rights Organizations |
| Czechia | ÚOOÚ; Kancelář veřejného ochránce práv | designated | Authorities under Article 77 of the AI Act |
| Finland | DPO, Non-Discrimination Ombudsman, Equality Ombudsman, Parliamentary Ombudsman, Consumer Ombudsman | designated | Authorities protecting fundamental rights under EU Artificial Intelligence Act |
| France | CNIL | announced | National Commission for Informatics and Liberties (CNIL) |
| Greece | HDPA, ADAE, National Commission for Human Rights, Ombudsman | designated | Fundamental-rights protection authorities |
| Ireland | Nine public authorities protecting fundamental rights | designated | Ireland leads the way in EU AI regulation |
| Luxembourg | Commission nationale pour la protection des données; ALIA; ITM | announced | CNPD competent-authority proposal |
| Malta | Information and Data Protection Commissioner | designated | IDPC as FRA and MSA under the AI Act |
| Romania | Avocatul Poporului; ANPC; CNCD; ANSPDCP; and other listed authorities | designated | Romania Article 77 list |
The justice-specific designations are the allocations to watch for legal AI. Germany creates a Bundesnetzagentur AI Market Surveillance Chamber for Annex III law-enforcement, border, justice and democracy systems. Denmark names the Danish Court Administration and relevant court authorities for certain court AI uses. Spain’s bill names the General Council of the Judiciary for AI systems used in justice administration. Slovenia allocates Annex III points 6 to 8 to the Information Commissioner.
Sandboxes, guidance and Digital Omnibus positions
Article 57 no longer required each Member State to have at least one operational sandbox by 2 August 2026. The milestones release says Regulation (EU) 2026/1744 defers the date to 2 August 2027. Three Member States already have operational sandboxes, three have designated operators and eight have announced sandboxes. The guidance materials counted here are narrower: they are national materials that reach deployers, courts, public bodies or legal-sector AI users.
| Instrument category | EU entries | Status split |
|---|---|---|
| Regulatory sandbox under Article 57 | 14 | designated 3; operational 3; announced 8 |
| Guidance for deployers | 13 | adopted 4; operational 7; announced 2 |
| Position on the Digital Omnibus | 1 | adopted 1 |
Denmark’s sandbox is operational through Digitaliseringsstyrelsen and Datatilsynet. Lithuania’s Innovation Agency page says ecosystem participants can already contact the AI sandbox for explanations. Spain’s Royal Decree 817/2023 remains the earliest operational controlled-testing source. Malta, Poland and Slovenia have legal designations; Germany, Cyprus, Finland, Greece, Hungary, Italy, Latvia and Luxembourg have announced sandboxes or statutory duties with no separate operational call found in the source set.
Guidance reaching legal practice appears in three forms. Some is broad deployer guidance, as with Austria’s RTR page, Germany’s Bundesnetzagentur service desk, Czechia’s ČTÚ page and the Dutch government guide. Some is sector guidance, as with Slovakia’s National Bank page. Some reaches justice directly: Greece’s AI.gov.gr justice webinars are for justice professionals, and Portugal’s Justice Minister said, “a IA pode apoiar a decisão judicial, mas nunca substituí-la”.
The Digital Omnibus position category is sparse. Belgium’s FPS Economy page explicitly records that implementation of the AI Act was adjusted by the Digital Omnibus. Switzerland is outside the EU framework and appears in the non-EU section because its Federal Council chose a Council of Europe Convention and sector-law route. No other Member State has a Digital Omnibus position in this release.
Where no verifiable instrument was found
The unknown entries are evidence of a search, not proof that nothing exists. Each entry states which official pages were checked and what was not verified. Belgium is included because the unresolved entry concerns final Article 70 implementation; the same state also has a verified Article 77 list and an Omnibus update. Slovakia is the only one not opened beyond its link.
| State | Read result | What was not verified | Notes |
|---|---|---|---|
| Belgium | Page checked | Artificial Intelligence Act | Checked 2026-09-07: FPS Economy AI Act page, linked Article 77 PDF, AI Act Service Desk Belgium filter/resources, federal-government pages. Only Article 77 list verified. |
| Bulgaria | Page checked | Digital Transformation | Checked 2026-09-07: Ministry of Transport and Communications digital-transformation pages, Bulgarian government/ministry pages, AI Act Service Desk Bulgaria filter/resources. No official implementation instrument found. |
| Croatia | Page checked | Ministry of Justice, Public Administration and Digital Transformation | Checked 2026-09-07: MPUDT/RDD homepage and digital-transformation navigation, AI Act Service Desk Croatia filter/resources, national official pages surfaced from those checks. No instrument found. |
| Estonia | Page checked | Artificial intelligence | Checked 2026-09-07: MKM, TTJA, RIA and Kratid official pages plus AI Act Service Desk Estonia filter/resources. Public-sector AI guidance exists, but no Article 70 instrument found. |
| Liechtenstein | Government page read | AI strategy of the national administration | Official government page read. LLV Office for Digital Innovation was a bot challenge; LLV EEA register pages were checked without a usable AI Act designation. |
| Portugal | Government page read | National Artificial Intelligence Agenda (ANIA) | Official government page read. ANACOM URLs contentId 1800891, 1853661, 1790409, 1850440 and categoryId 430029 timed out; no separate penalty law found. |
| Slovakia | Link not opened | Artificial Intelligence Act (AIA) | MIRRI returned security block; Slov-Lex LP/2025/25 was JS-only and static URL 404; UVO page robots-disallowed. NBS guidance was readable. |
Non-EU parallel approaches
Norway, Iceland and Liechtenstein are recorded because EEA incorporation affects AI Act reach in the European Economic Area. Switzerland and the United Kingdom are recorded as comparison jurisdictions only. They are outside the Member State duty to designate Article 70 bodies, set Article 99 penalties or operate Article 57 sandboxes under EU law.
| State | What official sources record | Sources |
|---|---|---|
| Norway | EEA-Lex records the AI Act as under scrutiny for incorporation, and Nkom states that it will be the coordinating market surveillance authority and national contact point. | Nkom designation entry; EFTA EEA-Lex entry; Digdir KI Norge sandbox entry. |
| Iceland | EEA-Lex records the Act as under scrutiny; Iceland’s AI Action Plan says a bill on artificial intelligence was scheduled for spring 2026. | EFTA EEA-Lex entry; Government AI Action Plan entries. |
| Liechtenstein | EEA-Lex records the Act as under scrutiny; no Liechtenstein AI Act authority designation was verified. | EFTA EEA-Lex entry; national-administration AI strategy entries. |
| Switzerland | The Federal Council route is a Swiss AI bill by the end of 2026, tied to the Council of Europe AI Convention, plus non-binding measures. | Federal Chancellery and OFCOM entries. |
| United Kingdom | The UK keeps a regulator-led, context-based AI model rather than adopting the EU AI Act. | DSIT white paper, AI Opportunities response, ICO, CMA and Ofcom entries. |
What to watch
The next dated sandbox event is 2 August 2027, the deferred Article 57 deadline. Before then, announced sandboxes should move into operational pages or formal legal designations: Germany’s Bundesnetzagentur sandbox, Finland’s Traficom framework, Greece’s HDPA/EETT sandbox, Italy’s AgID/ACN experimentation spaces, Latvia’s special regulatory environment and Luxembourg’s CNPD sandbox.
The next Article 99 watchpoint is whether states with adopted or delegated frameworks publish final fine procedures. Italy’s delegated sanctions system, Slovenia’s adopted law status, Spain’s bill, Romania’s draft and Sweden’s SOU 2025:101 are the entries most likely to move. The Commission’s first consolidated national market-surveillance-authority list, once published, should be compared state by state with this matrix.
Appendix A — data tables
The full 32-state matrix appears above. The two supporting tables below are the generated count table and the Member States without a national implementing act.
| Instrument category | Entries | Status split |
|---|---|---|
| National implementing act | 20 | in force 9; adopted 2; announced 1; bill 2; draft 6 |
| Authority designation | 63 | adopted 3; designated 46; announced 6; bill 3; draft 5 |
| Penalty regime under Article 99 | 11 | in force 6; adopted 2; bill 1; draft 2 |
| Regulatory sandbox under Article 57 | 15 | designated 3; operational 3; announced 9 |
| Guidance for deployers | 13 | adopted 4; operational 7; announced 2 |
| Position on the Digital Omnibus | 2 | adopted 1; announced 1 |
| Authority page | 23 | adopted 4; designated 1; operational 5; announced 6; unknown 7 |
| State | What was found instead of a national implementing act |
|---|---|
| Austria | authority page operational; authority page operational; deployer guidance operational; deployer guidance operational; authority designation designated |
| Belgium | authority page operational; authority page unknown; authority designation designated; Digital Omnibus position adopted |
| Bulgaria | authority page unknown |
| Estonia | authority page unknown; deployer guidance operational |
| France | deployer guidance operational; four authority designations announced |
| Croatia | authority page unknown |
| Portugal | authority page unknown; deployer guidance announced |
| Slovakia | authority page unknown; deployer guidance adopted |
Sources
Primary sources are linked on each state page. The main sources for the report are:
- EUR-Lex, Regulation (EU) 2024/1689 consolidated on 27 July 2026: consolidated text.
- EUR-Lex, Regulation (EU) 2026/1744: Digital Omnibus on AI, and the Commission’s entry-into-force page.
- Commission AI Act Service Desk: AI Act timeline and national resources.
- Commission Digital Strategy page: national single points of contact.
- Germany: KI-MIG, gesetze-im-internet.de.
- Finland: Law 1377/2025, Finlex.
- Denmark: Act No. 467, Retsinformation.
- Italy: Law 132/2025, Gazzetta Ufficiale.
- Spain: Bill 121/000096, Congreso PDF, and Royal Decree 817/2023, BOE.
- Poland: Act of 3 July 2026, ELI gazette, and official PDF.
- Ireland: S.I. 366/2025 and Regulation of Artificial Intelligence Act page.
- Greece: HDPA AI Act role page and AI.gov.gr resources.
- Malta: Legal Notice 226/2025 and IDPC AI Act page.
- Slovenia: ZIUDHPUI, Official Gazette.
- Sweden: Government assignment page and SOU 2025:101.
- Romania: ANCOM implementation page and ANCOM governance page.
- SafeLegalAI EU AI Act national implementation release: EU AI Act hub, state pages at
/regulation/eu-ai-act/<cc>, and the GitHub/Hugging Face release, table member_states. - Release pages: GitHub repository and Hugging Face release.
Reuse this research
Quote it, cite it, forward it — CC BY 4.0 for the data and figures; the linked official documents are the record. Suggested citation and a link to this exact report: